Start of new case 


Qi Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 
©) Unsure / don't know 
If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

( ) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


More example of redacting third party data in the business/customer context as the majority of request 
come from customers. Particularly where business look to redact the names of staff, who are only 
indirectly involved in any communications such as in the case of advising a colleague where to escalate 
matters to, or explaining the process they need to follow. 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 
from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 
requests below (if applicable). 


Complaint that have spanned several years, asking for the same information. 
Threats to staff. For example a 27 year old compliant, three internal reviews of 
complaint, repeated requests every time a new CEO appointed. Threats to staff, staff 
jobs / pension. Every time the individual does not get what the "what" they make a 
DSAR request / complaints against staff, using more than one regulator to raise 
issues. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-—Slightly Moderately 4-—Very 5- Extremely 
useful useful useful useful useful 


© 


Q6 Why have you given this score? 


Overall it provides more information on how subject access requests should be 
handled but more clarify required in a couple of areas. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


The section 'Can the right of access be enforced?’ is very light and does not explain 
how the ICO manages complaints. A big issue for businesses is that the ICO issues 
its judgement based on the information provided by the complainant, without any 
discussion with the business. Businesses wish to see this practice changed and the 
ICO to engage with the business first so that they can put their arguments forward 


before a final decision is made to mitigate any further damage to the relationship 
with the client. 


Q9 Are you answering as: 


ey An individual acting in a private capacity (eg someone providing their views as a 
— member of the public) 


© An individual acting in a professional capacity 
©.) On behalf of an organisation 

©) Other 

Please specify the name of your organisation: 
Vitalty 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
©) ICO Facebook account 
©) ICO LinkedIn account 
(C) ICO website 
© ICO newsletter 
~) ICO staff member 
|) Colleague 
©) Personal/work Twitter account 
() Personal/work Facebook account 
©) Personal/work LinkedIn account 
©) Other 


Thank you for taking the time to complete the survey 


